chore(ci): switch to oidc (#96)

Author: IvanJosipovic

.github/workflows/cicd.yml

@@ -11,6 +11,13 @@ on:
     types: [opened, reopened, synchronize]
   merge_group:
 
+permissions:
+  id-token: write
+  contents: write
+  actions: write
+  checks: write
+  issues: write
+
 jobs:
   build-test:
     name: Build & Test & Release
@@ -28,7 +35,7 @@ jobs:
       uses: docker/setup-buildx-action@v3
 
     - name: Semantic Release Dry Run
-      uses: cycjimmy/semantic-release-action@v4
+      uses: cycjimmy/semantic-release-action@v5
       id: semantic
       with:
         dry_run: true
@@ -87,16 +94,23 @@ jobs:
 
     - name: Semantic Release
       if: steps.semantic.outputs.new_release_published == 'true'
-      uses: cycjimmy/semantic-release-action@v4
+      uses: cycjimmy/semantic-release-action@v5
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         extra_plugins: |
           conventional-changelog-conventionalcommits
 
+    - name: NuGet login (OIDC → temp API key)
+      if: steps.semantic.outputs.new_release_published == 'true'
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: IvanJosipovic
+
     - name: .NET NuGet Push
       if: steps.semantic.outputs.new_release_published == 'true'
-      run: dotnet nuget push src/**/*.nupkg -s https://api.nuget.org/v3/index.json -k ${{ secrets.NUGET_API_KEY }}
+      run: dotnet nuget push src/**/*.nupkg -s https://api.nuget.org/v3/index.json -k ${{steps.login.outputs.NUGET_API_KEY}}
 
     - name: Docker Push
       if: steps.semantic.outputs.new_release_published == 'true'